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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). ' 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1)13 Responsive to communication(s) filed on 29 November 2004 . 
2a)l3 This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G. 21 3. 

Disposition of Claims 

4) [EI Claim(s) 22-27 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [X] Claim(s) 22-27 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) Q The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

1 2) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 

30 Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . The Amendment, and remarks therein, received on 7/30/2004 have been entered 
and carefully considered. 

2. The Amendment canceled claims 1-21 and introduces claims 22-27. 

3. The text of those sections of Title 35, U.S. Code not included in this action can be 
found in a prior office action. 

Response to Amendment 

4. Applicant's arguments have been carefully considered but they were not found 
persuasive. 

5. Applicant expresses the opinion that claims 22-27 are not taught by Sprague et al. 
but applicant's arguments are mainly directed towards the cancelled claim 1 and 
none towards the newly introduced claims 22-27. 

Since claim 1 is very similar to the newly introduced claim 22 the examiner 
addresses applicant's arguments in regard to claim 1 as though they were directed 
toward claim 22 in an attempt to assist applicant in understanding the examiner's 
correlation of the cited art with regard to applicant's invention as claimed . 

6. Applicant argues that in Sprague et al. "the proposed security applet must be small 
enough to fit into outboard RAM on the crypt unit" and as a result the teaching does 
not read on a number of the bits in a stream but rather on applets. 

7. The examiner points out that applets are small programs and execution, reading, 
writing etc. of these programs results in a stream of bits. 
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8. Furthermore, applicant argues that the inventive method involves "the identification 
of the existence of a possible virus program not only by the writing, reading and 
matching of the predetermined number of bits from a transmitted stream of bits but 
also by determining if any of the bits attempted to be written to the memory are also 
being transmitted improperly to a storage or other device, whether within the system 
or on the network." 

9. The examiner points out that the claim language (claim 22) does not reflect the 
arguments cited above. For example, the language does not mention any virus 
programs but merely talks about "the existence of one more unknown programs". 
Similarly, although claim 9 recites the limitation of "any of the bits attempted to be 
written to the memory are also being transmitted improperly to a storage or other 
device, whether within the system or on the network"; this limitation is preceded by 
"or" and as a result it is ignored in claim 22. 

1 0. Claims 22-27 have been examined. 

Claim Objections 

1 1 .The claims are objected to because the lines are crowded too closely together, 
making reading difficult. Substitute claims with lines one and one-half or double 
spaced on good quality paper are required. See 37 CFR 1 .52(b). 

12. Claim 26 is rejected under 35 U.S.C. 112, second paragraph, as failing to set forth 
the subject matter which applicant(s) regard as their invention. 
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13. Claim 26 recites "and identifies the existence of the one or more unknown programs 
if the bits read from memory do not match the bits attempted to be written to the 
memory or any of the bits attempted to be written to the memory have also been 
improperly transmitted to a storage or other device." 

The limitation as stated does not clearly state whether determination if "any of the 
bits attempted to be written to the memory have also been improperly transmitted to 
a storage or other device " is required before the existence of the one or more 
unknown programs is identified. 

14. Claims 22-24 are rejected under 35 U.S.C. 102(e) as being anticipated by Sprague 
et al (U.S. Patent No. 6449720). 

15. As per claim 22 Sprague et al. teach attempting to write a predetermined number of 
bits from a stream of bits to the memory in the system, wherein the predetermined 
number of bits is based on the size of the memory (Sprague et al, col. 3 lines 9-11), 
reading from the memory a number of bits equal to the predetermined number of bits 
attempted to be written to the memory (Computed MAC is compared, Sprague et al, 
col 10 \ines12-17), determining if the bits read from the memory match the bits 
attempted to be written to the memory (inspect, Sprague et al, col 3 lines 35-39), 
identifying by the spy device the existence of one more unknown programs if the 
read bits do not match the bits attempted to be written or if any of the bits attempted 
to be written to the memory are also being improperly transmitted to a storage or 
other device (recognized/known?, col 9 line 28-32 and col 10 lines 18-20). 
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16. As per claim 23 and 24 data inherently is transferred in stream of bits and Sprague 
et al. teach the predetermined number of bits that are attempted to be written to the 
memory include a pseudo-random.sequence of bits (Cryptographic keys, Sprague et 
al., col. 6 lines 22-23). 

17. Claim 27 is rejected under 35 U.S.C. 102(e) as being anticipated by Porras etal. 
(U.S. Patent No. 6321338). 

18. Porras et al. teach a computer system comprising a processor, a memory and a spy 
device (PC with a monitor device, Fig. 6, col. 14, line 46-48), the spy device 
observing the computer system internal operations to detect if a stream of bits 
transmitted to the computer system from a server have been improperly transmitted 
to a storage or other device within the computer system or transmitted back over the 
network to another computer system and (col. 1 lines 55-58, col. 2 lines 24-27), if so, 
alerting the server (col. 2 lines 4-7). 

19. Claims 25-27 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Sprague et al. (U.S. Patent No. 6449720) in view of Ji (U.S. Patent No. 5983348) 
and further in view of Schnureret al. (U.S. Patent No. 5842002). 

20. Sprague et al. teaches a system as discussed above. Sprague et al. } s invention is 
directed towards verifying applets in a computer system and not in a client server 
environment and as a result Sprague et al. does not teach the limitation "receiving at 
the client system from a server a stream of bits". 

However, the use of applets in a client/server environment is an old and well-known 
practice as illustrated by Ji (col. 1 lines 39-51). One of ordinary skill in art at the time 
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of applicant's invention would have been motivated to employ the use of applets in a 
client/server environment (that would read on receiving at the client system from a 
server a stream of bits) as taught by Ji to take advantage of many Internet and 
network computing technology. 

21 . Sprague et al. teaches determining if the bits read from the memory match the bits 
attempted to be written to the memory as discussed above. 

Sprague et al. does not explicitly teach determining that a virus may have entered 
the system if either the bits read from the memory do not match the bits attempted to 
be written to the memory. 

However, it is old and well-known that mismatch of information can be a sign of 
viruses. Ji explicitly discusses a technique similar to Sprague et al.'s invention 
wherein bits read from the memory don't match the bits attempted to be written to 
the memory suggest that a virus may have entered (Ji, col. 1 lines 26-39). One of 
ordinary skill in art at the time of applicant's invention would determine that a virus 
may have entered the system if either the bits read from the memory do not match 
the bits attempted to be written to the memory (as taught by Ji) in order to minimize 
potential damages. 

22. Ji teaches applet with digital signature being transferred from a server to a client (as 
discussed above) and as such it reads on bits being transmitted to a storage device 
or other device. Verification of the applet as safe (Ji, col. 1 lines 35-39) reads on a 
proper transfer and it is implicit that a lack of verification reads on an improper 
transfer. 
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23. Neither Sprague et al. nor Ji teach transmitting a message back to the server if it is 
determined that a virus may have entered the system. 

Schnurer et al. teach transmitting a message back to the server if it is determined 
that a virus may have entered the system (Schnurer et ai, col. 8 lines 27-35). 
It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to transmit a message back to the server if it is determined that a virus 
may have entered the system as taught by Schnurer et al. One of ordinary skill in the 
art would have been motivated to perform such a modification in order to prevent 
potential spread of viruses. 

24. Claims 26 and 27 are substantially equivalent to claim 25; therefore claims 26 and 
27 are similarly rejected. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peter Poltorak whose telephone number is (571 )272- 
3840. The examiner can normally be reached Monday through Thursday from 9:00 
a.m. to 4:00 p.m. and alternate Fridays from 9:00 a.m. to 3:30 p.m 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory Morse can be reached on (571)272-3838. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 



Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free). h 
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